Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong Value Of `_totalAssets`

nave765

Summary

StrategyArb::_harvestAndReport returns wrong amount of value of _totalAssets

Vulnerability Details

_harvestAndReport function is being used to harvest all rewards, redeploy any idle funds and return an accurate accounting of all funds currently held by the Strategy. The function spesifically being used to calculate all funds being held which is returned by the _totalAssets value.

@return _totalAssets A trusted and accurate account for the total amount of 'asset' the strategy currently holds including idle funds.

Based on the description of the returned function above, _totalAssets only contains asset and not the underlying which means underlying shouldn't be used as the value to be added in _totalAssets.

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol#L148-L170

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
_;
​
@> uint256 underlyingBalance = underlying.balanceOf(address(this));
​
_totalAssets =
unexchanged +
asset.balanceOf(address(this)) +
@> underlyingBalance;
}

Impact

  1. Wrong _totalAssets being returned by combining underlyingBalance in the variable.

  2. Incorrect value to be inputed while harvesting all rewards, and redeploying any idle funds.

Tools Used

Manual Review

Recommendations

function _harvestAndReport() internal override returns (uint256 _totalAssets) {
uint256 claimable = transmuter.getClaimableBalance(address(this));
​
if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}
​
// NOTE : we can do this in harvest or can do seperately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));
// }
​
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
​
// NOTE : possible some dormant WETH that isn't swapped yet
- uint256 underlyingBalance = underlying.balanceOf(address(this));
​
- _totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
+ _totalAssets = unexchanged + asset.balanceOf(address(this));
}
Updates

Appeal created

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.